[syslog-ng] syslog-ng OSE 3.5.1 is not accepting global options

Fri Mar 7 21:11:52 CET 2014

Hello,

I used grep to filter out all the "warning" messages from the compilation logs.  Here is what I found:

libtest/testutils.c:90: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'guint64'
libtest/testutils.c:90: warning: format '%06lu' expects type 'long unsigned int', but argument 3 has type 'guint64'
libtest/testutils.c:358: warning: cast from pointer to integer of different size
lib/logmatcher.c:318: warning: implicit declaration of function 'strcasestr'
lib/logmatcher.c:318: warning: assignment makes pointer from integer without a cast
/home/algernon/zwa/work/syslog-ng-ose-3.5/syslog-ng-ose/lib/cfg-lex.l:164: warning: passing argument 2 of 'parse_number_with_suffix' from incompatible pointer type
lib/filter/filter-in-list.c:85: warning: implicit declaration of function 'getline'

I hope this helps.

From: Balazs Scheidler [mailto:bazsi77 at gmail.com]
Sent: Friday, March 07, 2014 9:14 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] syslog-ng OSE 3.5.1 is not accepting global options

hmm... I think I may have a potential issue at hand, the function parse_number_with_suffix() returns its result using a long pointer, and time_reopen is just a int. Can it happen that you might use a big-endian platform where the size of a long and a int is different?
Do you have compilation warnings while compiling syslog-ng?

On Wed, Mar 5, 2014 at 11:24 PM, Tamayo, Andres <Andres.Tamayo at viasat.com<mailto:Andres.Tamayo at viasat.com>> wrote:

Hello,

I have found a solution to the problem (syslog-ng OSE 3.5.1 is not accepting global options) but I still do not understand what is the cause of the problem.

First some background information.  I have built syslog-ng into a buildroot toolchain and flashed into an embedded development board.  When I was prototyping my syslog-ng configuration file in the host computer, I was able to use configuration like this:

time_reopen(10);

However, when I started to use syslog-ng on the embedded target, the configuration previously mentioned did not work.  If I included this line in my syslog-ng.conf file; syslog-ng would automatically assume time_reopen was equal to zero and show debug messages like this one:

syslog connection failed; fd='8', server='AF_INET(192.168.1.10:1901)', error='Connection refused (146)', time_reopen='0'

If I deleted that configuration line from the configuration file, syslog-ng would use its default value.  This is the message I would see if the configuration line was removed:

syslog connection failed; fd='8', server='AF_INET(192.168.1.10:1901)', error='Connection refused (146)', time_reopen='60'

But what if I needed to use time_reopen=10 instead.

Anyway, as I said in the beginning I do now know what is causing this behavior but I found a solution.....hex notation.  If I use the following configuration line instead:

time_reopen(0xa);

Then, I would see the following syslog-ng debug message:

syslog connection failed; fd='8', server='AF_INET(192.168.1.10:1901)', error='Connection refused (146)', time_reopen='10'

The same is true for the following configuration items:

flush_timeout

log_fetch_limit

log_iw_size

log_fifo_size

max-connections

There may be other configuration items that exhibit the same behavior.

If anybody can explain why this is happening I would appreciate an explanation, thank you.

I hope this helps.

From: Tamayo, Andres [mailto:Andres.Tamayo at viasat.com]
Sent: Friday, February 28, 2014 3:49 PM
To: 'syslog-ng at lists.balabit.hu<mailto:syslog-ng at lists.balabit.hu>'
Subject: [syslog-ng] syslog-ng OSE 3.5.1 is not accepting global options

Hello,

I am experiencing problems with syslog-ng OSE 3.5.1 reading the configuration file and accepting its global options.  I had problems with 2 global options specified in my syslog-ng.conf file:

@version: 3.5
@include "scl.conf"

options
{
   flush_lines(0);
   time_reopen(10);
   log_fifo_size(1000);
   use_dns(no);
   use_fqdn(yes);
   keep_hostname(no);
   keep_timestamp(yes);
   chain_hostnames(no);

   perm(0640);
   owner("root");
   group("root");
   create_dirs(yes);
   dir_perm(0750);
   dir_owner("root");
   dir_group("root");
};

source s_cache
{
   file("/path/to/some/file.txt", flags(no-parse));
};

destination d_network
{
   syslog("192.168.1.10" port(1901) transport("tcp"));
};

log
{
   source(s_cache);

   destination(d_network);
};

The time_reopen and log_fifo_size seem to be forced to zero if I try to specify alternate values for them as shown above.  If I do not include them in the configuration file, syslog-ng uses their default values time_reopen=60 and log_fifo_size=10000.

Does anybody know what may be causing this problem?  The log_fifo_size default value is OK but I need a faster time_reopen window and I cannot find a way to specify it.  If I do, syslog-ng forces it to time_reopen=0.  I can tell because I get message like this when it is trying to reconnect:

Syslog connection failed; fd='8', server='AF_INET(192.168.1.10:1901)', error='Connection refused (146)', time_reopen='0'

If I remove the time_reopen(10) global option from the syslog-ng.conf file, then I get the following message when syslog-ng it is trying to reconnect:

Syslog connection failed; fd='8', server='AF_INET(192.168.1.10:1901)', error='Connection refused (146)', time_reopen='60'

Please let me know if you have any questions for me.

Thank you for your help.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<https://urldefense.proofpoint.com/v1/url?u=https://lists.balabit.hu/mailman/listinfo/syslog-ng&k=OWT%2FB14AE7ysJN06F7d2nQ%3D%3D%0A&r=o7GqWGDQQvuJbgvvR6T88i9N1FvBWrMPYBwWrEtosko%3D%0A&m=16SknfL7j%2BX1ubgX9ioRZvGkFNOo8zZXP4H%2FDFfAD1w%3D%0A&s=7318c0adc7da89373e2161bdd19e1e67b501143860cedfcc0170710796d6c29b>
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<https://urldefense.proofpoint.com/v1/url?u=http://www.balabit.com/support/documentation/?product%3Dsyslog-ng&k=OWT%2FB14AE7ysJN06F7d2nQ%3D%3D%0A&r=o7GqWGDQQvuJbgvvR6T88i9N1FvBWrMPYBwWrEtosko%3D%0A&m=16SknfL7j%2BX1ubgX9ioRZvGkFNOo8zZXP4H%2FDFfAD1w%3D%0A&s=6e3522f5af24f5eac3f00279f8610f63358d4c19e325bd777f784d2c7816c771>
FAQ: http://www.balabit.com/wiki/syslog-ng-faq<https://urldefense.proofpoint.com/v1/url?u=http://www.balabit.com/wiki/syslog-ng-faq&k=OWT%2FB14AE7ysJN06F7d2nQ%3D%3D%0A&r=o7GqWGDQQvuJbgvvR6T88i9N1FvBWrMPYBwWrEtosko%3D%0A&m=16SknfL7j%2BX1ubgX9ioRZvGkFNOo8zZXP4H%2FDFfAD1w%3D%0A&s=06498b7fe05f23a84c3b7ffad82f8a944379525e5a84c8772d65f0d8db89ae69>

--
Bazsi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20140307/b3db94f3/attachment-0001.htm 